What is the CVSS score of CVE-2026-24222?

CVE-2026-24222 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of NVIDIA NeMoClaw are affected by CVE-2026-24222?

NVIDIA NeMoClaw contains a critical sandbox bypass vulnerability (CVE-2026-24222, CVSS 8.6) that allows remote attackers to extract sensitive host environment variables through malicious prompts,…

How to fix or mitigate CVE-2026-24222?

Within 24 hours: Identify all systems running NVIDIA NeMoClaw and isolate instances accepting untrusted user input from network access or restrict to trusted internal users only. Within 7 days: Contact NVIDIA support for patch availability and timeline; implement compensating controls listed below if patching is delayed. Within 30 days: Deploy vendor patch immediately upon release and conduct forensic review of NeMoClaw instance logs for evidence of exploitation or environment variable exfiltration.

NVIDIA NeMoClaw CVE-2026-24222

EUVD-2026-26079 HIGH

Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497)

2026-04-28 nvidia

Information Disclosure Nvidia

8.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 28, 2026 - 20:23 vuln.today

cvss_changed

Analysis Generated

Apr 28, 2026 - 20:01 vuln.today

EUVD ID Assigned

Apr 28, 2026 - 19:30 euvd

EUVD-2026-26079

Analysis Generated

Apr 28, 2026 - 19:30 vuln.today

CVE Published

Apr 28, 2026 - 17:46 nvd

HIGH 8.6

DescriptionCVE.org

NVIDIA NeMoClaw contains a vulnerability in the sandbox environment initialization component, where a remote attacker could cause improper access control by sending prompt-injected content that causes the agent to read and exfiltrate host environment variables not properly restricted during sandbox creation. A successful exploit of this vulnerability might lead to information disclosure.

AnalysisAI

Remote unauthenticated attackers can exfiltrate sensitive host environment variables from NVIDIA NeMoClaw by injecting malicious prompts that bypass sandbox access controls. The vulnerability affects the sandbox initialization component and enables information disclosure without requiring any authentication or user interaction (CVSS 8.6, AV:N/AC:L/PR:N/UI:N). Cross-scope impact (S:C) indicates the attack breaks out of the intended sandbox boundary to access host-level secrets. EPSS and KEV status not available; this appears to be a recently disclosed AI/LLM agent security issue.

Technical ContextAI

NeMoClaw is an NVIDIA AI agent framework that uses sandbox environments to isolate agent execution. The vulnerability (CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere) occurs during sandbox initialization when environment variables from the host system are not properly restricted or filtered. Prompt injection attacks exploit the AI agent's instruction-following behavior to execute unintended commands - in this case, reading and transmitting environment variables that should remain isolated within the sandbox boundary. The affected CPE (cpe:2.3:a:nvidia:nemoclaw:*:*:*:*:*:*:*:*) indicates all currently released versions are vulnerable. This represents an emerging class of AI security vulnerabilities where natural language inputs bypass traditional access controls by manipulating the semantic layer rather than exploiting memory corruption or logic flaws.

RemediationAI

Consult the NVIDIA security advisory at https://nvidia.custhelp.com/app/answers/detail/a_id/5837 for official patch availability and upgrade instructions. Until a vendor patch is applied, implement these compensating controls: (1) Remove all sensitive credentials and secrets from environment variables accessible to the NeMoClaw sandbox - use secure secret management services (HashiCorp Vault, AWS Secrets Manager) with runtime injection instead. Trade-off: requires application refactoring. (2) Implement strict input validation and sanitization on all prompts before passing to the agent, filtering for common injection patterns (system commands, file access attempts, variable expansion syntax). Trade-off: may break legitimate use cases requiring dynamic prompting. (3) Deploy NeMoClaw in network-isolated environments with no internet access and restrict to processing only pre-validated, trusted content. Trade-off: limits agent functionality and integration capabilities. (4) Enable comprehensive logging of all agent inputs and outputs to detect exfiltration attempts via outbound connections or encoded responses. Trade-off: performance overhead and storage costs. None of these mitigations fully prevent exploitation; patching is the only complete solution.